Splunk Search

How to hide input based on another input?

splunkrocks2014
Communicator

I have two different inputs, "by usage" and "by process", and I want to use a radio button to control the those inputs to be visible to end -user. How can I do that? Thanks.

<form>
  <label>Process Tracking</label>
  <fieldset submitButton="false">
    <input type="radio" token="p_cat">
      <label>Category</label>
      <choice value="u">by Usage</choice>
      <choice value="p">by Process</choice>
      <default>u</default>
      <initialValue>u</initialValue>
    </input>
    <input type="text" token="p_process">
      <label>by Process</label>
    </input>
    <input type="dropdown" token="p_usage" searchWhenChanged="false">
      <label>by Usage</label>
      <search>
        <query>| inputlookup usage_ranges.csv</query>
        <earliest>0</earliest>
      </search>
      <fieldForLabel>range</fieldForLabel>
      <fieldForValue>range</fieldForValue>
      <initialValue>usage<1%</initialValue>
      <default>usage<1%</default>
    </input>
  </fieldset>
...
</form>
Tags (1)

somesoni2
Revered Legend

Try like this

<form>
   <label>Process Tracking</label>
   <fieldset submitButton="false">
     <input type="radio" token="p_cat">
       <label>Category</label>
       <choice value="u">by Usage</choice>
       <choice value="p">by Process</choice>
       <default>u</default>
       <initialValue>u</initialValue>
       <change>
         <condition label="by Usage">
           <set token="showProcess">Y</set>
           <unset token="showUsage"></unset>
         </condition>
         <condition label="by Process">
           <set token="showUsage">Y</set>
           <unset token="showProcess"></unset>
         </condition>
       </change>
     </input>
     <input type="text" token="p_process" depends="$showProcess$">
       <label>by Process</label>
     </input>
     <input type="dropdown" token="p_usage" depends="$showUsage$" searchWhenChanged="false">
       <label>by Usage</label>
       <search>
         <query>| inputlookup usage_ranges.csv</query>
         <earliest>0</earliest>
       </search>
       <fieldForLabel>range</fieldForLabel>
       <fieldForValue>range</fieldForValue>
       <initialValue>usage<1%</initialValue>
       <default>usage<1%</default>
     </input>
   </fieldset>
 ...
 </form>

splunkrocks2014
Communicator

Hi somesoni2, thank you for your solution. It works as expected. I have another question if you don't mind. When the "p_process" is set, I just want to pass "process="$p_process$" to the search query, but for the range, I want to remove "process="$p_process$" and adding a lookup for range. Basically, there will be different search queries corresponding to the condition. From the search panel, I tried to set up condition like below, but it doesn't work at all. What did I miss?
...



XYZ



index=abc sourcetype=efg | lookup my_lookup process AS process | where range="$p_usage$" | stats dc(host) AS count by process


index=abc sourcetype=efg process="$p_process$" | stats dc(host) AS count by process

$tk_query$
...

...

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...